Malware is usually very specific in what it does to your PC, whether that’s displaying ads, taking over your browser homepage and search bar, or nagging you to pay for some fake anti-virus. Hijacking however is potentially far more devastating, giving the hacker backdoor remote access to your entire PC.

This is the holy grail for how hackers hack, so it’s important to understand how it can occur and what you can do to protect yourself.

“Hi, I’m from the security team at Microsoft and we’ve detected a virus warning from your Windows PC”

They instruct you to open the event viewer, where there are lots of warning messages awaiting you, proving there must be something wrong!

They offer to fix it for you, you just need to go to this remote support site and download the remote control software.

They gain control of your PC, and proceed to do meaningless fixes, like opening file property dialogs.

The login details are passed onto a criminal network who now have full access to your PC anytime they wish, and a tidy commission is paid to the guy who made the call.

The fake technical support scam isn’t the only way this can occur of course – if you leave your computer in the hands of someone you can’t completely trust, there’s always a chance backdoor software could be installed. Although there’s no cases recorded, a Best Buy employee was found stealing raunchy pictures from a user’s PC – so there’s nothing to stop rogue repair technicians installing trojan software either.

For single user computers, it’s also quite likely they’re using the administrator account by default. The safest thing to do would be to set up a restricted user account for them to use on a daily basis, and ask them to never use the administrator account without talking to you first.

Browser Vulnerabilities – Flash & Java

Modern browsers are themselves rather secure. Chrome and more recently others run website tabs in their own sandboxed environment, where no changes can be made to the local filesystem. However, plugins such as Java operate outside of this sandbox, so these remain a concern.

If these plugins are enabled and not blocked by the browser, malicious Java or Flash code can be run as soon as you visit an infected site, or even loaded through the untrusted ad-network of a trusted site.

Thankfully, most of these problems are mitigated by simply :

running the latest version of a browser.

keeping up to date.

enabling “click to play” (so code doesn’t run automatically).

uninstalling the Java plugin completely.

Really, no decent website uses Java anymore (note: Java and Javascript are completely different), and the average home user does not run Java applications.

If you want to run a web server from your home PC, you’ll need to configure the router specifically to take incoming traffic for port 80 and forward it to your PC. Some applications and devices use uPnP, which handles this configuration of opening ports as and when required. If you have an Xbox 360 for instance and regularly play online, it’s using this to configure ports dynamically.

Port mapping involves a hacker scanning your router from the outside and systematically talking to every single port number, looking for open services. Once the services are found, the hacker is able to check certain characteristics that identify the version of software being run (“software footprints”). The version is then cross-checked against a database of known vulnerabilities, and if a match is found they can proceed with the exploit. Although this sounds laborious, in practice it’s a single tool to scan, cross-check and deliver the exploit.

Unless you’re doing things like setting up your own network servers and performing manual port forwarding, it’s unlikely you’re vulnerable to simple port scanning. However, if you’re curious about what ports are open on your home network, there’s a quick Internet-based tool available here, though you’re limited to the standard ports and 500 others. If you run Linux, check out the nmap tool for a more full test.

The exception to being protected by a router is when you’re connected to public Wifi. You’re placed on the same network as everyone else, and any one of them could be running a port scanner looking for vulnerable services.

Yes,I had my laptop hacked by a friend who no longer is a friend anymore. He put is keylogger to see when I typed in my passwords,then hacked my email plus put a admin password in the BIOS. When I got him to fix my computer he asked for my email password. Thinking nothing of it I gave it to him. I also got messages via mark channels maybe IRQ. One day his name showed up after many stupid messages were received. I checked the net for answers for help understanding the odd behaviors happening to my laptop. When I called him he got defensive. That is when he put an admin or supervisor password in the BIOS settings. The next time i went to boot up my laptop I could not get in without typing in an administrator password. After several panic attacks & several more rebooting tries the name "Mr Clean " showed up on the screen. This occurred during one of the reboot sessions. I called the guy back & asked how "Mr Clean " was doing & told him to go fly a flipping kite . This was why it took him three months to reinstall my Windows operating system . He needed the time to install all his hacking software .
I resolved everything by wiping my hard drive a million times...so to speak. Than I did a clean install & updated every update & Windows hotfix available.
soon after this incident a computer warehouse store was closing its door & selling their books for like 90% off. I bought a library full of books. Some of you may wonder why I did not report. Normally I would but his wife is & still is my best of best friends in the whole wide world. Best thing that happened is that it forced me to take charge of my own pc needs & I do.

I am disappointed that you failed to mention the excellent (and free) port checking program called "Shields Up" from grc.com. Steve Gibson has many other free security tools on his site and continues to comment on the Java plugin problems through his weekly podcast.

“Hi, I’m from the security team at Microsoft and we’ve detected a virus warning from your Windows PC”
That sounds so much like one of the Three Great Lies "I'm from the government, I'm here to help you".

James has a BSc in Artificial Intelligence, and is CompTIA A+ and Network+ certified. He's the lead developer of MakeUseOf, and spends his free time playing VR paintball and boardgames. He's been building PCs since he was a kid.